CVE Alert: CVE-2025-21487 – Qualcomm, Inc. – Snapdragon
CVE-2025-21487
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
AI Summary Analysis
Risk verdict
High risk of remote information disclosure via RTP payload processing; no user interaction or credentials required.
Why this matters
Exploitation could expose sensitive media or session data across a broad range of devices with network-facing RTP handling. For organisations, the impact includes data leakage, privacy risk, and potential groundwork for follow-on abuse if streams contain credentials or tokens.
Most likely attack path
An attacker remotely reachable over the network can trigger the vulnerability by sending crafted RTP payloads that exceed the decoder’s buffer. With no privileges or UI interaction needed and low attack complexity, successful exploitation risks information disclosure without broader system takeover. Scope is unchanged, but successful disclosure may enable targeted data exfiltration from affected sessions.
Who is most exposed
Devices that perform RTP decoding in the network stack—across mobile, IoT, automotive, and consumer wearables—are at risk. Any deployment exposing RTP-enabled services to attackers (e.g., VoIP/video streams) increases exposure.
Detection ideas
- Look for memory-disclosure anomalies tied to RTP payload handling (crashes, unusual offsets).
- Monitor RTP streams for anomalously large or malformed payload lengths.
- Correlate decoder crashes with network-originating RTP bursts.
- Inspect crash dumps and stack traces from network drivers for buffer over-read signatures.
- Identify repeated failures in RTP processing from unauthenticated sources.
Mitigation and prioritisation
- Apply vendor/firmware updates when released; validate in a lab before broad rollout.
- Implement network access controls to limit RTP exposure to trusted endpoints.
- Disable or harden RTP decoding where feasible; segment affected devices from sensitive networks.
- Prepare change-management plans to deploy updates across affected platforms.
- If KEV is true or EPSS ≥ 0.5, treat as priority 1. Otherwise monitor vendor advisories and risk.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
